An unvalidated Cross‑Site Request Forgery (CSRF) flaw in the Groovy Menu WordPress plugin up to version 1.4.3 allows an attacker to compel an authenticated site user to perform arbitrary actions, potentially resulting in unauthorized content or configuration changes. The vulnerability’s moderate CVSS score of 4.3 indicates that the primary impact is on the integrity of affected sites.

This weakness affects all installations of the grooni Groovy Menu plugin whose released versions are 1.4.3 or earlier, regardless of whether the free or paid edition is used.

Because the EPSS score is below 1% and the flaw is not in the CISA KEV catalog, the current risk of exploitation is low. Based on the description, it is inferred that the attack vector is a web-based request that exploits the plugin’s missing safeguarding against CSRF, requiring that a victim be logged into WordPress. An attacker could leverage this to modify or delete content without needing direct access to the server.